Update SCOPE to the finished USER-WP-0001–0023 surface
Replace the WP-0015 planning note with the shipped in/out boundary, published NetKingdom contracts, operator residuals, and an INTENT assessment. Fill the repo-boundary neighbor list to match.
This commit is contained in:
parent
3a6249b4c6
commit
275bfd530b
2 changed files with 124 additions and 54 deletions
|
|
@ -1,8 +1,18 @@
|
|||
## Repo boundary
|
||||
|
||||
This repo owns **user-engine** only. It does not own:
|
||||
This repo owns **user-engine** only: user-domain facts, identity-context
|
||||
mappings, projections, the optional portal, and the adapters that call
|
||||
neighbors.
|
||||
|
||||
<!-- TODO: List what belongs in adjacent repos, e.g.:
|
||||
- SSH key management → railiance-infra/
|
||||
- State hub code → state-hub/
|
||||
-->
|
||||
It does not own:
|
||||
|
||||
- OIDC login, tokens, passwords, MFA — key-cape / Keycloak
|
||||
- authorization decisions and protected-system registry — flex-auth
|
||||
- tenant identifier, grouping, and capability-role authority — tenant-engine
|
||||
- application-owned first-login profiles and action step-up — consuming apps
|
||||
- runtime secrets — OpenBao / railiance-platform
|
||||
- platform audit store — audit-core
|
||||
- transactional mail — email-connect
|
||||
- State Hub — state-hub
|
||||
- published policy site — policy-nexus
|
||||
- SSH certificates — ops-warden
|
||||
|
|
|
|||
158
SCOPE.md
158
SCOPE.md
|
|
@ -2,67 +2,127 @@
|
|||
|
||||
## One-Liner
|
||||
|
||||
Headless user-domain and identity-domain integration engine for accounts,
|
||||
identity links, actor/principal/subject context, preferences, memberships,
|
||||
application catalogs, projections, evidence references, audit, and events.
|
||||
Headless user-domain and identity-domain service for accounts, identity
|
||||
links, memberships, catalogs, projections, audit, and events, with an
|
||||
optional in-repo portal. It consumes NetKingdom IAM, authorization, tenant
|
||||
authority, provisioning, and delivery; it does not own them.
|
||||
|
||||
## In Scope
|
||||
|
||||
- user and account records;
|
||||
- account lifecycle state;
|
||||
- external identity links;
|
||||
- actor, authenticated subject, authorization principal, account, and user
|
||||
context mappings;
|
||||
- global, tenant, application, and membership profile values;
|
||||
- preference values;
|
||||
- user and account records, and account lifecycle state;
|
||||
- external identity links keyed by `(issuer, subject)`;
|
||||
- actor, authenticated-subject, authorization-principal, and user-context
|
||||
mappings from verified IAM Profile claims;
|
||||
- global, tenant, application, and membership profile values and
|
||||
preferences;
|
||||
- tenant, application, team, and scope memberships;
|
||||
- hats, realms, services, assets, access profiles, and active access
|
||||
context as user-domain facts;
|
||||
- identity-context read models for domain consumers;
|
||||
- canon interface cards, entity mappings, relationship mappings, and explicit
|
||||
- canon interface cards, entity and relationship mappings, and explicit
|
||||
gap records;
|
||||
- application registry for profile consumers;
|
||||
- customization catalog registry and validation;
|
||||
- effective profile resolution;
|
||||
- projection APIs for self-service, admin, application runtime, audit, and
|
||||
agent contexts;
|
||||
- audit records and lifecycle/profile-change events;
|
||||
- local evidence references derived from audit and event records;
|
||||
- local standalone development mode;
|
||||
- integration ports for identity claims, authorization checks, events, and
|
||||
runtime secrets;
|
||||
- adapter contracts for evidence export, policy/control references, and
|
||||
lifecycle task handoff.
|
||||
- customization catalog registry, versioning, and validation;
|
||||
- effective profile resolution and projections (self-service, admin,
|
||||
application runtime, audit, agent, claims-enrichment);
|
||||
- local audit records and durable outbox events;
|
||||
- local evidence references derived from audit and events;
|
||||
- invitations, prepared accounts, entitlement claims, and onboarding
|
||||
journeys that user-engine owns;
|
||||
- public registration *orchestration* (start, verify, resume, cancel,
|
||||
provider handoff) behind an explicit runtime flag;
|
||||
- provider-neutral tenant lifecycle *calls* to the tenant authority
|
||||
(create, read, update, retire, reactivate, recover);
|
||||
- optional CSRF-protected portal over the same APIs (self-service,
|
||||
onboarding, tenant admin, platform operator);
|
||||
- standalone/local fixtures and a production PostgreSQL store;
|
||||
- integration ports for claims, flex-auth decisions (including a rotating
|
||||
caller token), provisioning, registration verification, tenant
|
||||
management, outbox delivery, and runtime secrets.
|
||||
|
||||
## Out Of Scope
|
||||
|
||||
- login and authentication flows;
|
||||
- password, passkey, session, and MFA lifecycle;
|
||||
- OIDC/SAML token issuance;
|
||||
- final authorization policy decisions;
|
||||
- durable authorization grant authority outside user-engine-owned memberships;
|
||||
- policy, control, access-review, exception, and organization source-of-truth
|
||||
ownership;
|
||||
- runtime secret custody;
|
||||
- UI implementation in the current MVP; optional registration and access
|
||||
management UI work is proposed separately under `USER-WP-0014`;
|
||||
- full SCIM server or enterprise directory replacement in the initial product.
|
||||
- login, OIDC/SAML token issuance, passwords, passkeys, sessions, and MFA
|
||||
lifecycle — `key-cape`, Keycloak, or `local-identity`;
|
||||
- final authorization policy decisions and the protected-system registry —
|
||||
`flex-auth`;
|
||||
- durable authorization grants beyond user-engine-owned memberships;
|
||||
- tenant identifier authority, grouping reclassification, and capability
|
||||
role grants — `tenant-engine`;
|
||||
- application-owned first-login profiles, unlink, and action step-up —
|
||||
consuming apps (e.g. coulomb-social) and KeyCape client policy;
|
||||
- policy, control, access-review, exception, and organization
|
||||
source-of-truth ownership;
|
||||
- runtime secret custody — OpenBao / Railiance;
|
||||
- platform audit store and transactional SMTP — `audit-core` and
|
||||
`email-connect`;
|
||||
- full SCIM server, enterprise directory replacement, or inbound
|
||||
SAML/OIDC federation (demand-triggered; Keycloak expanded mode is the
|
||||
published path);
|
||||
- a generic extracted profile engine.
|
||||
|
||||
The in-repo portal is an optional surface, not a UI product. Password and
|
||||
MFA screens stay on the identity provider.
|
||||
|
||||
## Boundary Rule
|
||||
|
||||
user-engine owns user-domain facts, identity-context mappings, and projections.
|
||||
Other systems may provide authentication, IAM claims, authorization decisions,
|
||||
policy/control authority, deployment, event transport, durable audit, secrets,
|
||||
organization records, or UI surfaces, but they must integrate through explicit
|
||||
interfaces rather than becoming hidden sources of profile or identity-domain
|
||||
truth.
|
||||
user-engine owns user-domain facts, identity-context mappings, and
|
||||
projections. Adjacent systems provide authentication, IAM claims,
|
||||
authorization decisions, tenant authority, policy/control definitions,
|
||||
deployment, event transport, durable audit, secrets, organization records,
|
||||
or additional UI — and they integrate through explicit adapters. They must
|
||||
not become hidden sources of profile or identity-domain truth.
|
||||
|
||||
## Current Planning
|
||||
Governing published contracts:
|
||||
|
||||
Implementation and planning work is tracked in `workplans/USER-WP-0001`
|
||||
through `USER-WP-0015`. `USER-WP-0010` implements the first headless
|
||||
registration and factor-evidence slice. `USER-WP-0011` implements prepared
|
||||
accounts and entitlement claims. `USER-WP-0012` implements hats, realms,
|
||||
services, assets, access profiles, active context, and exportable
|
||||
access-control facts. `USER-WP-0013` implements onboarding journeys and
|
||||
welcome protocols. `USER-WP-0014` implements the optional registration and
|
||||
access-management UI contract facade. `USER-WP-0015` implements registration
|
||||
scenario and security conformance tests.
|
||||
- IAM Profile v0.3 — https://policy.coulomb.social/standards/iam-profile/v0.3/
|
||||
- Tenancy Posture v0.1 — https://policy.coulomb.social/standards/tenancy-posture/v0.1/
|
||||
- NetKingdom architecture — https://policy.coulomb.social/architecture/net-kingdom/v0.1/
|
||||
- User-engine boundary contract (accepted, not yet published) —
|
||||
`~/net-kingdom/canon/standards/user-engine-boundary-contract_v0.1.md`
|
||||
|
||||
## Current Status
|
||||
|
||||
Workplans `USER-WP-0001` through `USER-WP-0023` are finished. There is no
|
||||
active workplan. The isolated MVP, multi-tenancy, catalogs, canon
|
||||
alignment, durable PostgreSQL store, self-service and admin portal,
|
||||
public-registration orchestration, and flex-auth caller identity (live A2
|
||||
on `flex-auth-user-engine`) are in the repo and, where applicable, on
|
||||
Railiance.
|
||||
|
||||
Still operator-owned, not remaining product scope:
|
||||
|
||||
- public registration and outbox mail stay fail-closed until governed
|
||||
OpenBao verification/delivery tokens and the transactional SMTP lane
|
||||
are installed;
|
||||
- the live tenant-lifecycle probe from a user-engine pod (GET / PATCH /
|
||||
retire / reactivate on a disposable tenant) is still owed;
|
||||
- `policy.enabled` and tenant-engine caller `enforce` belong to flex-auth
|
||||
/ tenant-engine.
|
||||
|
||||
## Against INTENT.md
|
||||
|
||||
INTENT is the stable aspiration. Against it, the repo now does the job it
|
||||
set out to do.
|
||||
|
||||
| INTENT aim | Status |
|
||||
| --- | --- |
|
||||
| Headless user-domain service, provider- and PDP-agnostic | Met. Ports and adapters; production uses IAM Profile v0.3 and flex-auth. |
|
||||
| Standalone now, multi-tenant / multi-app later | Met. Fixtures and in-memory conformance plus live PostgreSQL and Railiance. |
|
||||
| Users, links, memberships, catalogs, projections, events | Met. |
|
||||
| NetKingdom identity-domain integration layer | Met for the owned slice. Consumes KeyCape, flex-auth, tenant-engine, identity-provisioner, audit-core, email-connect. |
|
||||
| Applications answer who / which scopes / what to project | Met via `/me`, identity context, catalogs, and projections. |
|
||||
| Not an IdP, PDP, secret store, directory, or org authority | Held. |
|
||||
| Optional UI, not UI-driven | Held, with a narrower reading: an optional portal now lives *in this repo* over the same APIs. INTENT's "not a UI application" still applies to product identity. |
|
||||
| Canon-aligned mappings without taking IAM as SoT | Met (`USER-WP-0007`, interface card). Access-review, policy, and control remain references, not owned records. |
|
||||
| Path from local setup to governed NetKingdom deploy | Met. |
|
||||
|
||||
Still aspirational, and deliberately not started here:
|
||||
|
||||
- inbound federation / SCIM / directory sync — new workplan only on tenant
|
||||
demand, targeting published Keycloak expanded mode;
|
||||
- first-class access-review and governance records;
|
||||
- a dedicated agent consumption product (projections exist);
|
||||
- extracting a generic profile engine.
|
||||
|
||||
Those remain INTENT, not a hole in SCOPE.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue